This Red Hat security advisory addresses multiple vulnerabilities in the golang packages for Red Hat Enterprise Linux 10. The issues include CVE-2026-27140 (arbitrary code execution via malicious SWIG file names in cmd/go), CVE-2026-27143 (possible memory corruption after bound check elimination in cmd/compile), CVE-2026-27144 (no-op interface conversion bypassing overlap checking in cmd/compile), CVE-2026-32280 (denial of service in certificate chain building in crypto/x509), CVE-2026-32282 (Root.Chmod following symlinks out of root in internal/syscall/unix), and CVE-2026-32283 (denial of service via multiple TLS 1.3 key update messages in crypto/tls). Red Hat has released updated golang packages (version 1.25.9-3.el10_1) to fix these vulnerabilities across multiple architectures. The advisory rates the update as important and provides instructions for applying the update.

The vulnerabilities collectively allow for arbitrary code execution, denial of service conditions, memory corruption, and unauthorized file system access via symlink traversal. These issues could be exploited by attackers to disrupt services, execute malicious code, or bypass security checks in applications built with the affected golang compiler and libraries. The impact is significant given the core role of golang in software development and runtime environments on affected Red Hat Enterprise Linux 10 systems.

Red Hat has released updated golang packages (version 1.25.9-3.el10_1) that address all identified vulnerabilities. Users should apply these official updates promptly to remediate the security issues. Detailed instructions for applying the update are available at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the vendor-provided patches.